2009/11/13 by Wei Yu, Nan Zhang, Xinwen Fu +1 · 1 citation
Computer Science · #Network Security and Intrusion Detection #Internet Traffic Analysis and Secure E-voting #Advanced Malware Detection Techniques
paper · doi:10.1109/tpds.2009.161
openalex publication_date 2009/11/13 · openalex created_date 2025/10/10 · openalex updated_date 2026/06/11
In this paper, we address issues related to the modeling, analysis, and countermeasures of worm attacks on the Internet. Most previous work assumed that a worm always propagates itself at the highest possible speed. Some newly developed worms (e.g., “Atak” worm) contradict this assumption by deliberately reducing the propagation speed in order to avoid detection. As such, we study a new class of worms, referred to as self-disciplinary worms. These worms adapt their propagation patterns in order to reduce the probability of detection, and eventually, to infect more computers. We demonstrate that existing worm detection schemes based on traffic volume and variance cannot effectively defend against these self-disciplinary worms. To develop proper countermeasures, we introduce a game-theoretic formulation to model the interaction between the worm propagator and the defender. We show that an effective integration of multiple countermeasure schemes (e.g., worm detection and forensics analysis) is critical for defending against self-disciplinary worms. We propose different integrated schemes for fighting different self-disciplinary worms, and evaluate their performance via real-world traffic data.